Weaknesses of type CWE-89

13,394 results

Injeção SQL

Ocorre quando entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O aplicativo executa a consulta alterada, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Example

Um formulário de login que monta a query assim: `SELECT * FROM users WHERE email = '" + emailDoFormulario + "'`. Se o usuário digitar `admin'--`, a query vira `SELECT * FROM users WHERE email = 'admin'--'` e bypassa a validação de senha, autenticando como admin.

How to mitigate

Use prepared statements ou stored procedures com parâmetros vinculados (bind parameters). Em Java use PreparedStatement; em Python use placeholders com psycopg2 ou SQLAlchemy; em qualquer linguagem evite concatenação de strings. Combine com validação de entrada e princípio do menor privilégio no banco de dados.

CVE-2018-25172HIGHPedidos 1.0 SQL Injection via load_proveedores.phpEPSS 0.3%CVE-2019-25521HIGHXooGallery Lastest Latest SQL Injection via gal.php gal_idEPSS 0.3%CVE-2025-30022MEDIUMCM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.EPSS 0.3%CVE-2026-114065HIGHTrigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table PlaceholdersEPSS 0.3%CVE-2025-41004HIGHMultiple vulnerabilities in Imaster products Open configuration optionsEPSS 0.3%CVE-2025-41005HIGHMultiple vulnerabilities in Imaster products Open configuration optionsEPSS 0.3%CVE-2025-22209MEDIUMExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for JoomlaEPSS 0.3%CVE-2026-110911CRITICALWheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOEPSS 0.3%CVE-2025-13385MEDIUMBookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' ParameterEPSS 0.3%CVE-2024-34933MEDIUMA SQL injection vulnerability in /model/update_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to EPSS 0.3%CVE-2026-104456HIGHYesWiki before 4.6.7 Second-Order SQL Injection via ACL UsernameEPSS 0.3%CVE-2024-33804MEDIUMA SQL injection vulnerability in /model/get_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to eEPSS 0.3%CVE-2026-79811HIGHAuthenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager APIEPSS 0.3%CVE-2026-17418HIGHIBM i is Affected By Multiple Vulnerabilities in SQLEPSS 0.3%CVE-2026-79794CRITICALAuthenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management InterfaceEPSS 0.3%CVE-2026-76309MEDIUMStructured Query Language (SQL) Injection through the REST API in Splunk EnterpriseEPSS 0.3%CVE-2025-10002MEDIUMClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injectionEPSS 0.3%CVE-2015-10146MEDIUMThumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL InjectionEPSS 0.3%CVE-2015-10147MEDIUMEasy Testimonial Slider and Form <= 1.0.2 - Authenticated (Admin+) SQL injectionEPSS 0.3%CVE-2025-10048MEDIUMMy Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL InjectionEPSS 0.3%